Introduction
invoia is a web service for invoicing and monthly revenue recognition, made for consultancies and agencies that invoice through their own Dinero accounting organisation.
The service is provided by:
Creo Digital CVR no. DK45246132 support@invoia.io
This privacy policy describes how personal data is processed in the service — on the public pages, in the registration and sign-in flow, and in the product itself. It covers both the data we process about you as a user and the data our customers put into the service about other people.
We have not appointed a data protection officer. All enquiries about personal data go to support@invoia.io.
Controller and processor
We have two roles, and they must be kept apart.
Where we are the controller
Creo Digital is the controller of the data we process for our own purposes, about our own users and paying accounts:
- account and profile — name, email address, role, language preference, optional profile picture
- data relating to sign-in and two-factor authentication
- security events
- evidence that the Terms and the Privacy Policy were accepted
- billing identity — company name, billing address, VAT number, subscription status
- an administrative log of actions in account administration
- measurement of how the service is used
Where we are a processor
We are a processor of the personal data our customers put into the service, or have the service fetch. Here the customer is the controller:
- the debtor register — a continuously refreshed copy of the customer's contact book in Dinero
- the customer's own employees — hourly rates, distribution percentages, and the hours and completion rates registered per user per month
- all of the above, when it is disclosed to a third party the customer has itself granted access — see Access you grant to third parties
We process this data on the customer's documented instructions. Those instructions consist of our Terms, the customer's use of the service's features and the customer's own configuration. The service has no settings with which a customer can limit which fields are stored, which sub-providers are used, or how long anything is kept. The Article 28 processor terms sit in the Terms and constitute the data processing agreement between the customer and us.
One record, two roles
The user profile is both things at once. It is the user's identity at sign-in — there we are the controller. It is at the same time the employee record, with hourly rate and monthly productivity, that the customer's admins can analyse — there we are a processor. The line between the two roles runs by data category, not by where the data is stored.
What personal data we process
Data you give us
Account and profile. Email address, password (kept only in hashed form by our authentication provider), first and last name, the company name on the account, role (admin or standard user), language preference and an optional profile picture.
Billing. Billing company name, billing address, billing email, VAT number, subscription status, trial end date, and customer and subscription identifiers at our payment provider. Card details are entered directly into the payment provider's own field and never pass through our servers.
Invitations. The email address of the person an admin invites, and the status of the invitation.
Data that arises when the service is used
Sign-in and two-factor authentication. One-time codes for verifying the email address are kept only as a hash, together with IP address and user agent. The secret for two-factor authentication with an authenticator app is kept encrypted. Setting it up also generates a set of backup codes per user, which are kept only as hashes.
Security events. Event type, timestamp, IP address, user agent, and a data field that may contain the email address. Today, only events around the creation and verification of a user are recorded.
Evidence of acceptance. That the Terms and the Privacy Policy were presented and accepted at registration, which version, when, plus IP address and user agent.
Administrative log. Which admin invited, changed or removed a user, created or revoked an API key, or changed a webhook endpoint — and every single call to our public API, with timestamp, path, status code and key identifier.
Device reading. On the sign-in and registration pages, a script in your browser computes an identifier from the characteristics of your browser and device. The computation happens locally, and no data is sent to the supplier of that script. The identifier travels with the request to our server. The reading takes place without prior consent. The security features the identifier was intended for store nothing today, so in practice the identifier is not retained by us.
Measurement of how the service is used. Our hosting provider's web analytics is active on all pages — including the sign-in and registration pages and the whole signed-in workspace. It records page views with address, referring page, browser and device type, coarse geographic location and IP address. This measurement is not conditioned on a cookie choice today.
Notifications. In-app messages about, for example, changes to the set of users or the status of an accounting connection.
Data our customers put in
For debtor data and for data about the customer's own employees we are a processor.
Debtors. Name, attention person, email address, phone number, street, postcode, city, country, VAT number, EAN, SE and P numbers, website, whether the debtor is a private individual, payment terms, send method, and preferred currency and invoice language. The copy is refreshed daily from the customer's Dinero organisation and covers the entire active debtor register — not only the debtors created in invoia. When a user creates or edits a debtor in invoia, the change is written to Dinero first.
The customer's employees. The default hourly rate on the user profile, hourly rate and distribution percentage per invoice line, and registered hours and completion rate per user per month, recording who registered them.
Free-text fields. Descriptions on invoice lines and notes contain whatever the customer wrote in them. We do not filter them and cannot know what they contain.
Purposes and legal basis
References are to Article 6(1) of the General Data Protection Regulation.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and administering the account and its users | name, email address, company name, role | (b) — performance of the contract |
| Verifying the email address with a one-time code | email address, hash of the code, IP address, user agent | (b), and (f) — protection against abuse |
| Sign-in and mandatory two-factor authentication | email address, password, encrypted authenticator-app secret | (b) |
| Checking the password against known breached passwords | the first five characters of a hash of the password | (f) — security |
| Reading device characteristics at sign-in and registration | identifier computed in the browser | (f) — security. The reading happens on your own device and is not conditioned on consent today |
| Security logging | event type, IP address, user agent, email address | (f) — security |
| Administrative log of account changes and API calls | admin, action, entity, timestamp | (f) — traceability in the customer relationship |
| A record that the Terms and the Privacy Policy were presented and accepted at registration | acceptance, version, timestamp, IP address, user agent | (c), and Article 5(2) — accountability |
| Subscription, payment and VAT identification | billing details, VAT number, number of users | (b), and (c) — bookkeeping and VAT rules |
| Transactional email: verification, password reset, change of email address, invitation | email address and the content of the message | (b) |
| In-app notifications | user, account, message content | (b) and (f) |
| Measuring how the service is used | address, referring page, browser, device type, coarse geography, IP address | (f) — legitimate interest in operating and improving the service |
| Invoicing and revenue recognition — debtor register, invoices, credit notes, series, work registrations and accrual vouchers | the customer's own data | Processor. The customer is the controller and determines the basis |
| Delivery of the invoice to the end-customer, performed by Dinero and not by us | invoice document and recipient address | Processor. The customer is the controller |
| Analysis of registered hours and recognised revenue per named user | user, month, hours, revenue | Processor. The customer is the controller, typically relying on (f) |
Consent is not the legal basis for any of the processing above. The choice made in the cookie banner does not today decide whether any script runs.
Recipients
We do not sell personal data and do not use it for third-party marketing. We use the following providers.
| Recipient | Purpose | What they receive | Where |
|---|---|---|---|
| Supabase | Database and authentication | Everything in the service, including passwords in hashed form | eu-west-1 (Ireland) |
| Vercel | Hosting, CDN and web analytics | All traffic to the service, with the IP address as sender, plus page views on every page | Global network; region not stated |
| Stripe | Subscription and payment | Company name, billing address, billing email, VAT number and number of users. Card details are entered directly with Stripe | Global |
| Resend | Transactional email | The recipient's email address and the full content of the message, including one-time codes | Region not stated |
| Inngest | Running background jobs | Event data that may contain user id, name, email address, device name, coarse geography and IP address | Region not stated |
| Visma / Dinero | Invoicing, bookkeeping and delivery of the invoice | Debtor details, invoices with line amounts, credit notes, products and accrual vouchers. Dinero — not invoia — sends the invoice to the end-customer | api.dinero.dk |
| Visma / e-conomic | Invoicing, bookkeeping and delivery of the invoice | Debtor details, invoices with line amounts, credit notes, products and accrual vouchers. e-conomic — not invoia — sends the invoice to the end-customer. Back the other way we fetch the agreement's own details: company name, agreement number, CVR number, base currency, and the agreement's debtors and products, which we hold as a copy | secure.e-conomic.com |
| Have I Been Pwned (operated via Cloudflare) | Checking against known breached passwords | Only the first five characters of a hash of the password, plus our server's IP address. Never the password and never your IP address | Global |
| Google and Microsoft | Sign-in with a Google or Microsoft account, brokered through Supabase | The sign-in request itself, if you choose that option | Global |
| Upstash | Rate limiting on the public API | Only an identifier for the API key used, where the feature is enabled | Region not stated |
| Frankfurter | Daily exchange rates | No personal data — only currency codes and dates | api.frankfurter.dev |
| Twilio | Sending SMS | No data today. The service does not send SMS | Region not stated |
We may also disclose data where we are legally required to do so.
Transfers outside the EU/EEA
Our database and authentication sit with Supabase in eu-west-1 (Ireland).
For the remaining providers:
- Stripe and Cloudflare (which operates the breached-password checking service) run global networks. Processing outside the EU/EEA cannot be ruled out.
- For Vercel, Resend, Inngest, Upstash and Twilio we cannot determine from our own configuration in which region the processing takes place, and we therefore state no region.
We do not reproduce here which transfer mechanism each provider relies on. If you need information about a specific provider, write to support@invoia.io.
Access you grant to third parties
An admin on the account can give systems outside invoia access to the account's invoicing data in two ways:
- API keys for our public API.
- Authorising an external client through our MCP server, where the client is granted access on the customer's behalf after an approval screen.
It is a deliberate part of the product that the external client may be an AI assistant. The MCP server is built so that such clients can register themselves, after which a user with access to the integration in question approves the access.
Such access covers debtors with name, address, email address, phone number, attention person and VAT number; products; invoices, credit notes and series with amounts; work registrations; and the account's users with name, email address, role and default hourly rate. A key or token with write access can additionally book an invoice into the customer's Dinero and have it sent to the customer's end-customer.
Data that leaves the service by this route leaves it on the customer's own instruction. The recipient is then a recipient in its own right, and the recipient's own terms and privacy policy govern the further processing. We cannot see what the recipient does with the data.
invoia itself sends no data to any AI provider. There is no language model and no AI processing anywhere in the service. The only route by which personal data from the service can reach an AI service is the one the customer opens above.
Limits the customer should know:
- API keys do not expire. A key is valid until an admin revokes it in the account settings.
- An authorisation granted to an external client lapses if it is unused for 30 days.
- There is today no overview in the app of which external clients hold an active authorisation, and no self-service way to revoke one. Write to support@invoia.io if an authorisation is to be brought to an end.
Employee analytics
An admin on an account can, in the company analytics view, see each named user month by month: registered hours and recognised revenue, up to 60 months back. Users are shown by first and last name, and by email address where the name is missing. Users who have been removed from the account may also appear by name in the history.
There is today no opt-out, no setting and no notice to the individual employee in the product.
Deferred revenue and work in progress are never computed per employee — only earned revenue and hours are.
We provide this feature as a processor. The customer is the controller of this processing and must itself establish the basis and inform its own employees, including under section 12 of the Danish Data Protection Act on the processing of data in employment relationships.
Retention and deletion
The main rule: data is kept for as long as the account exists. We do not set fixed deletion periods for business data. Debtors, invoices, invoice lines, work registrations, accrual vouchers, security events, administrative logs, evidence of acceptance and user profiles are not deleted after any fixed period.
Expired one-time codes for email verification, two-factor setups that were started but never completed, and unused backup codes are cleared out on an ongoing basis. We do not state fixed periods for that clean-up here.
Evidence of acceptance. We keep one record per user. If a new version of the Terms or the Privacy Policy is accepted, the new record replaces the previous one. We do not keep a history of earlier acceptances.
Deleting an account
There is no self-service deletion in the product. Write to support@invoia.io. Deletion is carried out manually by us and is agreed case by case; we cannot delete parts of an account automatically, so a deletion can take time. The following limits are ones we cannot work around, and the customer must understand them before a deletion is agreed:
- What the service has booked into the customer's own Dinero. Contacts, booked invoices, credit notes and accrual vouchers sit in the customer's own accounting organisation. It is the customer's own bookkeeping material, which we cannot delete, and Dinero refuses deletion of booked material. Its retention follows the Danish Bookkeeping Act and the customer's own agreement with Visma/Dinero.
- The payment provider. The customer object at Stripe, with company name, billing address, VAT number, billing email and invoice history, is not deleted. It is Creo Digital's own accounting material.
- An invoiced debtor cannot be deleted individually. Once an invoice has been issued to a debtor, the invoice's reference blocks deletion of that debtor.
- Backups. Data may persist in our providers' backups for a period determined by the provider. We do not state a figure here that we cannot stand behind.
Deletions the customer triggers
- If an admin disconnects Dinero or e-conomic, the connection is closed, and our copy of the credential and the accounting system's own reference lists are deleted at once. No invoice, credit note, series or work registration is deleted — those are the customer's own financial history, not a copy of the accounting system's. The debtors and products we mirrored from the accounting system are deleted 30 days after the connection ended, except those an issued invoice refers to: they are part of that document and are kept with it. The 30 days are the window for reconnecting the same organisation and finding the catalogue intact.
- If a user is removed from the account, that user's registered hours and completion rates are deleted along with their allocation to invoice lines. The user account itself at our authentication provider is retained.
Your rights
Under the General Data Protection Regulation you have the right of access to the data we process about you, the right to rectification, the right to erasure, the right to restriction of processing, the right to object and the right to data portability.
How to exercise them: write to support@invoia.io.
All enquiries are handled manually by a person. There is no self-service tool in the product and there is no export feature — a copy of your data is compiled manually. We do not set out a response deadline here beyond the one that follows from the law.
We do not rely on consent as a legal basis, see Purposes and legal basis. There is therefore no consent given to us that can be withdrawn.
Are you an employee or a customer of a company that uses invoia? Then that company is the controller of the data about you, and your request should be directed to them. If you write to us, we forward the request to our customer and assist them in answering it.
Complaints to Datatilsynet
You may lodge a complaint with Datatilsynet about our processing of your personal data. We would like to hear from you first at support@invoia.io, but that is not a condition for complaining.
Cookies and local storage
The service sets the cookies needed to sign in, keep you signed in and protect against forged requests, plus a cookie that remembers your language preference. The full inventory is in the Cookie Policy.
Three points belong here as well:
- Your choice in the cookie banner is stored in your browser's local storage. We create no record of that choice on our servers today, and no script is switched on or off by it.
- The cookie banner appears only on the public pages. The sign-in and registration pages and the signed-in workspace have no cookie banner.
- Third-party scripts. The payment provider's script is loaded on the payment step during registration and in the billing settings.
Security
Briefly and factually, what the service actually does:
- Access to business data is enforced in the database. Row level security is enabled on all tables, and a user's access is bound to the integration they have been granted access to.
- Two-factor authentication is mandatory for every account.
- The secret for two-factor authentication with an authenticator app is stored encrypted with AES-256-GCM. Beyond that field we do not apply our own field-level encryption in the database.
- One-time codes and API keys are stored only as hashes.
- Card details never pass through our servers.
- Passwords are checked against a public register of breached passwords, where only the first five characters of a hash leave our server.
See Security for further detail. We hold no certifications, audit reports or published test reports, and therefore present none.
Changes to this policy
We update this policy when the service changes. The version and date appear at the top of the page, and changes take effect when they are published here. We do not keep a public archive of earlier versions.
Language
This policy is written in Danish. The English version is a translation provided for convenience. In the event of any discrepancy between the two versions, the Danish version governs.
Contact
Creo Digital CVR no. DK45246132 support@invoia.io
We have not appointed a data protection officer.